InfoSecBulletin Cybersecurity for mankind
Chinese-speaking hackers have added Claude, Qwen, and DeepSeek to their hacking system to automate cyberattacks on governments and other targets in Asia, according to a report from the threat intelligence company Hunt.io.
Hunt.io says this operation is different from the campaign seen in July, where a Chinese-speaking operator used Claude Code and DeepSeek in attacks in four countries. The new campaign used AI models. It focused on Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government and education in mainland China, and businesses in Da Nang, Vietnam.
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Hunt.io found five open directories related to the campaign. They connected them using shared tools, like a SOCKS proxy endpoint found in different places. The systems had common SecFlow and GLUTTON items, shared accounts, and a direct link to the second-stage payload.
According to the researchers, a Fengtai District government environment was hit hardest, “where the operator achieved command execution, collected LSASS and registry hives, accessed government and health records, and deployed multiple Windows implants. Separate activity exposed a Chinese education AI platform and obtained root database access to a university campus-card system.”
The attackers accessed into a government Office Automation system that was open to the internet. They did this by using a file management tool that let them upload ASPX files and find web-accessible locations.
This let the hackers use tools on the server inside the app. They later moved a 75.8MB LSASS memory dump with important login details in 37 parts.
They got the SAM and SYSTEM registry files and set up a server page, extract.aspx, that looked for Windows password data. Then they found 822 OA account records and made a new active OA account with higher permissions. The OA storage had 949 attachments that added up to about 1.28GB.
Researchers found that the recovered material had government work and admin info, some health documents, a chronic disease report with patient details, and Windows login data.
